Attachment 13145 Details for Bug 30060 – difference between the CVE patch

[patch] difference between the CVE patch

CVE_sturmvogel.patch (text/plain), 597 bytes, created by christian barranco on 2022-02-17 20:40:53 CET

(hide)

Description:

Filename:

MIME Type:

Creator: christian barranco

Created: 2022-02-17 20:40:53 CET

Size: 597 bytes

patch

obsolete

--- exiv2-0.27.4/src/jp2image.cpp	2021-06-15 09:57:33.000000000 -0400
+++ exiv2-0.27.4/src/jp2image.cpp.dlucio	2021-07-04 17:42:08.883791376 -0400
@@ -245,9 +245,10 @@ static void boxes_check(size_t b,size_t
 
             if (box.length == 0) return ;
 
-            if (box.length == 1)
+            if (box.length < 8)
             {
-                // FIXME. Special case. the real box size is given in another place.
+                 // box is broken, so there is nothing we can do here
+                 throw Error(kerCorruptedMetadata);
             }
 
             switch(box.type)

Actions: View | Diff

Attachments on bug 30060: 13132 | 13133 | 13134 | 13135 | 13136 | 13137 | 13140 | 13141 | 13142 | 13143 | 13144 | 13145